# Vulnerabilities published in 2023


- [CVE-2023-24410](https://insights.sbomify.com/CVE-2023-24410/): WordPress FluentForm Plugin <= 4.3.25 is vulnerable to SQL Injection (medium 5.5)
- [CVE-2023-24409](https://insights.sbomify.com/CVE-2023-24409/): Cross-site scripting in WP Responsive Tabs horizontal vertical and accordion Tabs (high 7.1)
- [CVE-2023-24408](https://insights.sbomify.com/CVE-2023-24408/): WordPress Ecwid Shopping Cart Plugin <= 6.11.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-24407](https://insights.sbomify.com/CVE-2023-24407/): WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability (medium 5.0)
- [CVE-2023-24406](https://insights.sbomify.com/CVE-2023-24406/): WordPress Simple Popup Images Plugin <= 1.8.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24405](https://insights.sbomify.com/CVE-2023-24405/): WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-24404](https://insights.sbomify.com/CVE-2023-24404/): WordPress Marketing Performance Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-24403](https://insights.sbomify.com/CVE-2023-24403/): WordPress bbPress Voting Plugin <= 2.1.11.0 is vulnerable to Cross-Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24402](https://insights.sbomify.com/CVE-2023-24402/): WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24401](https://insights.sbomify.com/CVE-2023-24401/): WordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24400](https://insights.sbomify.com/CVE-2023-24400/): WordPress Cookie Notice & Compliance for GDPR / CCPA Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-2440](https://insights.sbomify.com/CVE-2023-2440/): UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation (high 8.8)
- [CVE-2023-24399](https://insights.sbomify.com/CVE-2023-24399/): WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.5)
- [CVE-2023-24398](https://insights.sbomify.com/CVE-2023-24398/): WordPress EZP Coming Soon Page Plugin <= 1.0.7.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24397](https://insights.sbomify.com/CVE-2023-24397/): WordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24396](https://insights.sbomify.com/CVE-2023-24396/): WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24395](https://insights.sbomify.com/CVE-2023-24395/): WordPress Contact Form 7 Redirect & Thank You Page Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-24394](https://insights.sbomify.com/CVE-2023-24394/): WordPress iframe popup Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24393](https://insights.sbomify.com/CVE-2023-24393/): WordPress Animated Number Counters Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-24392](https://insights.sbomify.com/CVE-2023-24392/): WordPress Full Width Banner Slider Wp Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-24391](https://insights.sbomify.com/CVE-2023-24391/): WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24390](https://insights.sbomify.com/CVE-2023-24390/): WordPress WeSecur Security Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2439](https://insights.sbomify.com/CVE-2023-2439/): Cross-site scripting in UserPro - Community and User Profile WordPress Plugin (medium 6.4)
- [CVE-2023-24389](https://insights.sbomify.com/CVE-2023-24389/): WordPress Social Proof (Testimonial) Slider Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24388](https://insights.sbomify.com/CVE-2023-24388/): Cross-site request forgery in Booking calendar, Appointment Booking System (medium 5.4)
- [CVE-2023-24387](https://insights.sbomify.com/CVE-2023-24387/): WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24386](https://insights.sbomify.com/CVE-2023-24386/): WordPress AI Contact Us Form Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24385](https://insights.sbomify.com/CVE-2023-24385/): WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24384](https://insights.sbomify.com/CVE-2023-24384/): WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-24383](https://insights.sbomify.com/CVE-2023-24383/): WordPress Namaste! LMS Plugin <= 2.5.9.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24382](https://insights.sbomify.com/CVE-2023-24382/): WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-24381](https://insights.sbomify.com/CVE-2023-24381/): WordPress Advanced Social Pixel Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24380](https://insights.sbomify.com/CVE-2023-24380/): WordPress Simple Wp Sitemap Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-2438](https://insights.sbomify.com/CVE-2023-2438/): UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata (medium 6.1)
- [CVE-2023-24379](https://insights.sbomify.com/CVE-2023-24379/): WordPress Landing Page Builder – Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion vulnerability (medium 6.8)
- [CVE-2023-24378](https://insights.sbomify.com/CVE-2023-24378/): WordPress Glossary Plugin <= 2.1.27 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-24377](https://insights.sbomify.com/CVE-2023-24377/): WordPress Ecwid Shopping Cart Plugin <= 6.11.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-24376](https://insights.sbomify.com/CVE-2023-24376/): WordPress WP Simple Events Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24375](https://insights.sbomify.com/CVE-2023-24375/): Missing authorization in WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) (low 3.5)
- [CVE-2023-24374](https://insights.sbomify.com/CVE-2023-24374/): WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-24373](https://insights.sbomify.com/CVE-2023-24373/): WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability (low 3.7)
- [CVE-2023-24372](https://insights.sbomify.com/CVE-2023-24372/): WordPress Simple Custom Author Profiles Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2437](https://insights.sbomify.com/CVE-2023-2437/): UserPro <= 5.1.1 - Authentication Bypass to Administrator (critical 9.8)
- [CVE-2023-24369](https://insights.sbomify.com/CVE-2023-24369/): Cross-site scripting in ujcms:ujcms (medium 6.1)
- [CVE-2023-24366](https://insights.sbomify.com/CVE-2023-24366/): Path traversal in rconfig:rconfig (medium 6.5)
- [CVE-2023-24364](https://insights.sbomify.com/CVE-2023-24364/): SQL injection in oretnom23:simple customer relationship management system (high 8.8)
- [CVE-2023-2436](https://insights.sbomify.com/CVE-2023-2436/): Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode (medium 4.4)
- [CVE-2023-24352](https://insights.sbomify.com/CVE-2023-24352/): Memory corruption in dlink:dir-605l firmware (critical 9.8)
- [CVE-2023-24351](https://insights.sbomify.com/CVE-2023-24351/): Memory corruption in dlink:dir-605l firmware (critical 9.8)
- [CVE-2023-24350](https://insights.sbomify.com/CVE-2023-24350/): Memory corruption in dlink:dir-605l firmware (critical 9.8)
- [CVE-2023-2435](https://insights.sbomify.com/CVE-2023-2435/): Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Local File Inclusion via Shortcode (high 7.2)
- [CVE-2023-24349](https://insights.sbomify.com/CVE-2023-24349/): Memory corruption in dlink:dir-605l firmware (critical 9.8)
- [CVE-2023-24348](https://insights.sbomify.com/CVE-2023-24348/): Memory corruption in dlink:dir-605l firmware (critical 9.8)
- [CVE-2023-24347](https://insights.sbomify.com/CVE-2023-24347/): Memory corruption in dlink:dir-605l firmware (high 8.8)
- [CVE-2023-24346](https://insights.sbomify.com/CVE-2023-24346/): Memory corruption in dlink:dir-605l firmware (high 8.8)
- [CVE-2023-24345](https://insights.sbomify.com/CVE-2023-24345/): Memory corruption in dlink:dir-605l firmware (high 8.8)
- [CVE-2023-24344](https://insights.sbomify.com/CVE-2023-24344/): Memory corruption in dlink:dir-605l firmware (high 8.8)
- [CVE-2023-24343](https://insights.sbomify.com/CVE-2023-24343/): Memory corruption in dlink:dir-605l firmware (high 8.8)
- [CVE-2023-2434](https://insights.sbomify.com/CVE-2023-2434/): Nested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset (low 3.8)
- [CVE-2023-24334](https://insights.sbomify.com/CVE-2023-24334/): Memory corruption in tenda:ac23 firmware (high 8.0)
- [CVE-2023-24333](https://insights.sbomify.com/CVE-2023-24333/): Memory corruption in tenda:ac21 firmware (high 8.8)
- [CVE-2023-24332](https://insights.sbomify.com/CVE-2023-24332/): Memory corruption in tenda:ac6 firmware (high 8.1)
- [CVE-2023-24331](https://insights.sbomify.com/CVE-2023-24331/): Command injection in dlink:dir-816 firmware (critical 9.8)
- [CVE-2023-24330](https://insights.sbomify.com/CVE-2023-24330/): Command injection in dlink:dir-882 firmware (high 8.8)
- [CVE-2023-2433](https://insights.sbomify.com/CVE-2023-2433/): YARPP – Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-24329](https://insights.sbomify.com/CVE-2023-24329/): Security feature bypass in fedoraproject:fedora (high 7.5)
- [CVE-2023-24323](https://insights.sbomify.com/CVE-2023-24323/): XML external entity in mojoportal:mojoportal (high 8.8)
- [CVE-2023-24322](https://insights.sbomify.com/CVE-2023-24322/): Cross-site scripting in mojoportal:mojoportal (medium 6.1)
- [CVE-2023-24320](https://insights.sbomify.com/CVE-2023-24320/): Missing authorization in axcora:axcora (critical 9.8)
- [CVE-2023-24317](https://insights.sbomify.com/CVE-2023-24317/): File upload in judging management system project:judging management system (high 8.1)
- [CVE-2023-2431](https://insights.sbomify.com/CVE-2023-2431/): Bypass of seccomp profile enforcement (low 3.4)
- [CVE-2023-24308](https://insights.sbomify.com/CVE-2023-24308/): Memory corruption in pdf-xchange:pdf-xchange editor (high 7.8)
- [CVE-2023-24304](https://insights.sbomify.com/CVE-2023-24304/): Code injection in irfanview:irfanview (high 7.8)
- [CVE-2023-2430](https://insights.sbomify.com/CVE-2023-2430/): Race condition in kernel (medium 5.5)
- [CVE-2023-24295](https://insights.sbomify.com/CVE-2023-24295/): Memory corruption in softmaker:flexipdf (high 7.8)
- [CVE-2023-24294](https://insights.sbomify.com/CVE-2023-24294/): Memory corruption in zumtobel:netlink ccd firmware (high 7.5)
- [CVE-2023-24291](https://insights.sbomify.com/CVE-2023-24291/): Memory corruption in Portable Puzzle Collection (low 2.9)
- [CVE-2023-2429](https://insights.sbomify.com/CVE-2023-2429/): Improper Access Control in thorsten/phpmyfaq (medium 6.6)
- [CVE-2023-24288](https://insights.sbomify.com/CVE-2023-24288/): Denial of service in Portable Puzzle Collection (low 2.9)
- [CVE-2023-24287](https://insights.sbomify.com/CVE-2023-24287/): Memory corruption in Portable Puzzle Collection (low 2.9)
- [CVE-2023-24286](https://insights.sbomify.com/CVE-2023-24286/): Memory corruption in Portable Puzzle Collection (low 2.9)
- [CVE-2023-24285](https://insights.sbomify.com/CVE-2023-24285/): Memory corruption in Portable Puzzle Collection (low 2.9)
- [CVE-2023-24284](https://insights.sbomify.com/CVE-2023-24284/): Memory corruption in Portable Puzzle Collection (low 2.9)
- [CVE-2023-24283](https://insights.sbomify.com/CVE-2023-24283/): Memory corruption in Portable Puzzle Collection (low 2.9)
- [CVE-2023-24282](https://insights.sbomify.com/CVE-2023-24282/): File upload in poly:trio 8800 firmware (medium 5.4)
- [CVE-2023-2428](https://insights.sbomify.com/CVE-2023-2428/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 6.1)
- [CVE-2023-24279](https://insights.sbomify.com/CVE-2023-24279/): ONOS vulnerable to reflected cross-site scripting (medium 6.1)
- [CVE-2023-24278](https://insights.sbomify.com/CVE-2023-24278/): Cross-site scripting in squidex.io:squidex (medium 6.1)
- [CVE-2023-24276](https://insights.sbomify.com/CVE-2023-24276/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-2427](https://insights.sbomify.com/CVE-2023-2427/): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (medium 6.1)
- [CVE-2023-24269](https://insights.sbomify.com/CVE-2023-24269/): File upload in textpattern:textpattern (high 8.8)
- [CVE-2023-24261](https://insights.sbomify.com/CVE-2023-24261/): Command injection in gl-inet:gl-e750 firmware (high 7.2)
- [CVE-2023-2426](https://insights.sbomify.com/CVE-2023-2426/): Use of Out-of-range Pointer Offset in vim/vim (medium 6.8)
- [CVE-2023-24258](https://insights.sbomify.com/CVE-2023-24258/): SQL injection in spip:spip (critical 9.8)
- [CVE-2023-24256](https://insights.sbomify.com/CVE-2023-24256/): Path traversal in nio:aspen (high 7.8)
- [CVE-2023-24253](https://insights.sbomify.com/CVE-2023-24253/): SQL injection in domoticalabs:ikon server (critical 9.8)
- [CVE-2023-24251](https://insights.sbomify.com/CVE-2023-24251/): Cross-site scripting in wangeditor:wangeditor (medium 5.4)
- [CVE-2023-2425](https://insights.sbomify.com/CVE-2023-2425/): SourceCodester Simple Student Information System Add New Course cross site scripting (low 2.4)
- [CVE-2023-24249](https://insights.sbomify.com/CVE-2023-24249/): laravel-admin has Arbitrary File Upload vulnerability (high 7.2)
- [CVE-2023-24243](https://insights.sbomify.com/CVE-2023-24243/): Server-side request forgery in cdata:arc (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/374/